The email landed at 4:47 on a Tuesday afternoon, and it looked like every other notice from HR.
It had the company logo, the right colors, the same footer.
It asked her to "verify" her direct deposit information before a payroll system upgrade.
She had thirty minutes, the message warned.
So she did what any tired person would do at the end of a workday.
That click is what the security industry calls phishing — a fake message designed to trick you into handing over passwords, banking details, or access to your own accounts.
The word comes from "fishing," because someone is dangling bait and waiting.
Except the pond now includes your inbox, your texts, your DMs, and increasingly, your phone calls.
A real company can spend millions on firewalls, and it won't matter if a receptionist in accounts payable believes a fake invoice from a "vendor." The FBI's Internet Crime Complaint Center logged hundreds of thousands of phishing complaints in recent years, with reported losses climbing into the tens of millions — numbers that only count the people who bothered to file a report.
The scams have gotten strangely personal.
Attackers scrape your LinkedIn to learn your boss's name and your job title.
They spoof a charity right after a hurricane.
They pose as the IRS in April, your bank after a data breach, or a delivery service the week you actually ordered something.
During tax season, fake refund notices spike.
Around the holidays, it's "your package is held." The bait changes with the calendar because the scammers are reading the same news you are.
Older Americans absorb a disproportionate share of the damage, but nobody is immune.
Security researchers have watched college students, engineers, and even IT staff fall for well-built fakes.
Phishing preys on the moment you're rushed, scared, or distracted — the exact conditions of an ordinary American workday.
A single compromised email account can be used to phish everyone in that person's contact list, which means the whole office learns to distrust every message.
Banks spend on fraud departments and pass the cost along.
Hospitals get locked out of patient records.
Small businesses that lose a payroll account sometimes never reopen.
The erosion is cumulative: a society where a voicemail from your own daughter might be an AI-generated fake, and you're supposed to verify it with a code word.
Don't click links in unexpected messages — navigate to the site yourself.
Turn on two-factor authentication, especially on email and banking.
Slow down when a message creates urgency, because urgency is the weapon.
And when you do get fooled, say so quickly, because the silence around these scams is part of what keeps them profitable.
We built a digital life that runs on trust — trust in logos, in senders, in the little padlock icon — and we handed the keys to anyone with a copy of Photoshop and a mailing list.
It's a tax on human decency, collected daily from people who were simply trying to do their jobs.
Final Thoughts
The least we can do is stop treating its victims as fools.